Obfuscation and Repetition, (Mon, Oct 5th)
The obfuscated payload of a maldoc submitted by a reader can be quickly extracted with the “strings method” I explained in diary entry “Quickie: String Analysis is Still Useful“.
Author Archives: SANS Internet Storm Center, InfoCON: green
ISC Stormcast For Monday, October 5th 2020 https://isc.sans.edu/podcastdetail.html?id=7194, (Mon, Oct 5th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 5th 2020 https://isc.sans.edu/podcastdetail.html?id=7194, (Mon, Oct 5th)
Nmap 7.90 Released, (Sun, Oct 4th)
Nmap 7.90 is released, right after the release of Npcap 1.00, .
Nmap 7.90 Released, (Sun, Oct 4th)
Nmap 7.90 is released, right after the release of Npcap 1.00, .
Scanning for SOHO Routers, (Sat, Oct 3rd)
In the past 30 days lots of scanning activity looking for small office and home office (SOHO) routers targeting Netgear.
Analysis of a Phishing Kit, (Fri, Oct 2nd)
Sometimes, attackers make mistakes and allow security researchers&#;x26;#;xc2;&#;x26;#;xa0;to access interesting resources. This time, it&#;x26;#;39;s another phishing kit that was left in the wild on the compromised server.
ISC Stormcast For Friday, October 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=7192, (Fri, Oct 2nd)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 2nd 2020 https://isc.sans.edu/podcastdetail.html?id=7192, (Fri, Oct 2nd)
IOC’s turning into IOOI’s, (Thu, Oct 1st)
Remember, back in the days, when the anti-virus vendors looked with derision at some of their competition, exclaiming “But they are using just SIGNATURES. Our tool detects BEHAVIOURS”. That was like 15 years ago. Fast forward to today, with many of the same vendors now selling “threat intelligence feeds” for good money, and the most frequent attributes pushed over these feeds are MD5/SHA1 hashes and IP addresses. The main thing that changed is that we now call these items “IOCs” (Indicators of Compromise) instead of “signatures”, but they still mostly are what they always were: Binary fingerprints that are very easy for an attacker to change.
ISC Stormcast For Thursday, October 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7190, (Thu, Oct 1st)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Thursday, October 1st 2020 https://isc.sans.edu/podcastdetail.html?id=7190, (Thu, Oct 1st)
Making sense of Azure AD (AAD) activity logs, (Thu, Oct 1st)
Chances are, you are quite familiar with the logs of your on-premises Active Directory (AD) domain controller. The corresponding Event IDs have been well documented over the years (though not thanks to Microsoft), and many blog posts have been written about how to use AD logs to detect Pass-the-Hash, brute force attempts, Kerberoasting, and more.
Continue reading Making sense of Azure AD (AAD) activity logs, (Thu, Oct 1st)